decentraland / signatures-server / 32884591724

92%

main: 92%

Pull #490

github

fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded metadata key bypass

`rejectIfSigner('decentraland-kernel-scene')` guards POST /v1/rentals-listings,
the "listings are created by the wallet owner, never by a scene" gate. The
predicate read the exact `signer` key, so metadata delivering
{"Signer": "decentraland-kernel-scene"} presented no `signer` at all and the
gate treated it as absent, answering "allowed" for a request that visibly names
the signer it exists to refuse, and letting a scene create a rental listing on
the owner's behalf.

This is reachable on the strict, current-format path. Since 6.0.0 the signed
payload covers the metadata bytes verbatim, so re-spelling the key changes what
the client signs and the request has to be signed that way, which a
scene-driven client can do. This service passes no `canonicalMetadataKeys`, so
the legacy fallback never engages and the strict path is the only one in play.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField`, which
`rejectIfSigner` is built on, so a key that case-folds to `signer` without
being spelled exactly that is a rejection rather than an absence.

The added regression test signs the current 6.x payload itself rather than
going through `getSignedAuthHeaders`, which folds the whole joined string and
so can only exercise the legacy shape. @dcl/crypto is declared as a
devDependency for it; it was already resolved at 3.7.0, so the lockfile gains
no new entry.

The caret range already allowed 6.3.0, so the lockfile refresh is the part that
actually ships the fix; the range is bumped so the intent is explicit.

345 of 372 branches covered (92.74%)

Branch coverage included in aggregate %.

680 of 746 relevant lines covered (91.15%)

48.52 hits per line